Greetings,
I'm trying to create an alert for low bandwidth utilization for a cluster of devices that are always going to show 0% utilization. These are on 10g interfaces with a burst of traffic every hour, and the rest of the time the traffic is 10kbps or so. So SolarWinds shows utilization at 0% most of the time.
The OID in question is stHttpsTraffic on a MacAFee web proxy, and is a 64 bit counter. There will be occasional normal individual polling cycles where the counter will not increment, and utilization will be zero, so I plan to trigger the alert after the condition exists for 10 to 15 minutes, the polling cycle is every 2 minutes. Because of the 10 to 15 minute match window, handling counter rollover isn't much of a priority, the 0's generated by a counter rollover will not impact the alert, so handling that event isn't a priority.
Normally I would just put in a percentage based alert on a bandwidth counter for an interface, but the interfaces in question sit at 0% even when they have normal traffic. Altering the port speed is off the table, these ports are built to handle high loads from events, so the 10g headroom is intentional. But the day to day traffic is normal when it is less than 50k, I only need to trigger an alert when it drops to zero and stays there. The particular counter I am using is the one with the most traffic, and the least amount of time at 0, so this is why I want to use this one.
I'm new to SolarWinds, but this is trivial in other SNMP systems I've used over the years. I'm having trouble figuring out how to read the counter as a rate, the rest of the alert logic is working fine, I have the custom poller and the specific members of the cluster selected for the trigger correctly, I'm just having trouble understanding how to do the current_value minus previous_value calculation, or to simply select this as a bit counter so the math is done by SolarWinds. This should be really simple. In the attached image I've got the trigger logic correctly selecting the 8 nodes specific to this alert, but I can't find how to read the counter as a bandwidth gauge. So obviously the actual trigger condition is just there so I can test that the rest of the logic is working. The trigger condition line needs to be adjusted to correctly read the stHttpsTraffic variable as a rate, either because I use a facility to interpret it correctly, or because I do the (current_value - previous_value) calculation.
